I am facing here a problem with sharing the sharepoint Fedauth cookie with an WebApi application where both sharepoint and WebApi registred by ADFS. Both applications are hosted under the same domain and on-premise but on different machines. We have the same implementation between the WebApi and another MVC application where everything works fine. We are able to establisch sso calls both through the browsers as with server side httpclient calls. In other words:
We are able to establish SSO between Sharepoint and Webapi through the browser. We are unable to establish SSO between Sharepoint and Webapi through Httpclient call. We get the next error in the windows event viewer:
Exception type: SecurityTokenException Exception message: ID4230: The SecurityToken was not well formed. Expecting element name 'SecurityContextToken', found 'SP'. at System.IdentityModel.Tokens.SessionSecurityTokenHandler.ReadToken(XmlReader reader, SecurityTokenResolver tokenResolver)
I have read some topics on the internet where it is recommended to give the fedauth cookie another unique name. However this was unsuccesfull as the webpi redirect the call to ADFS.
Any help will be apreciated.